Privacy Policy — Forme & Nutrition

Last updated: September 10, 2026

This English version is a translation provided for convenience. The French version is the legally reviewed reference text.

This policy explains how Forme & Nutrition processes the personal data of site visitors, customer account holders, and people using its programs and support services.

It supplements the Terms and Conditions of Sale and the information presented in data collection forms.

1. Data controller

The data controller is:

Ivan PAGÈS — Sole trader (EI)
Forme & Nutrition
9 rue Romain Rolland, 13200 Arles, France
SIREN: 877 735 902
SIRET: 877 735 902 00042
R.C.S. Tarascon
Email: forme.nutrition2@gmail.com
Phone: +33 6 13 75 09 44

Any question about data protection can be sent to these details.

2. Origin and categories of data

Data mainly comes from the information you provide when creating your account, placing an order, completing a questionnaire or check-in, or exchanging messages with Forme & Nutrition.

Some information is also generated while using the site or provided by the service providers needed to operate the service, notably payment confirmation.

Depending on the services used, the data processed includes:

Identification and contact: first and last name, email address, billing details and other contact details needed for your request.
User account: account identifier, authentication information managed by the dedicated service, and data needed to manage access.
Orders and subscriptions: offers purchased, dates, amounts, references and payment statuses, invoices, refunds, support period and cancellation requests.
Personalization: age, sex where relevant, height, weight, goals, eating habits, preferences, physical activity and fitness level.
Follow-up: check-in answers, program adjustments, messages and information shared during support.
Information that may relate to health: allergies, intolerances, injuries, physical limitations and other information strictly necessary to adapt the service.
Technical data: IP address, browser and device information, login events and logs needed for the site's operation and security.
Audience-measurement data: pages viewed, browsing events and technical identifiers, when the relevant tool is enabled according to your choices.
Choices and requests: cookie preferences, consents collected and rights requests.

Weight, body measurements and certain follow-up data may also constitute health data where they allow information about your health to be inferred.

Please do not send complete medical records or personal information with no necessary connection to the service.

3. Purposes and legal bases

Use of data	Legal basis
Responding to a request about an offer before purchase	Pre-contractual steps taken at your request
Creating and managing the customer account, delivering PDFs and managing access	Performance of the contract
Processing orders, subscriptions, payments and refunds	Performance of the contract
Preparing programs and providing the agreed follow-up	Performance of the contract; additional condition for health data set out in Article 4
Sending order confirmations, availability notices and other messages needed for the service	Performance of the contract
Issuing and keeping invoices and mandatory records	Compliance with legal obligations
Securing the site, detecting abusive access and preventing fraud	Legitimate interest in protecting the service, users and transactions
Handling complaints and keeping records needed to defend legal rights	Performance of the contract or legitimate interest in establishing, exercising or defending legal rights, depending on the processing
Responding to GDPR rights requests	Compliance with legal obligations
Using Google Analytics to measure audience	Prior consent

Processing based on a legitimate interest is limited to what is necessary and takes into account its impact on your rights and freedoms.

Accepting the Terms does not amount to general consent to all data processing.

4. Health data and explicit consent

Health information is only collected where it has a direct and necessary connection to the service offered.

For this information, Forme & Nutrition relies on your explicit consent, in accordance with Article 9(2)(a) of the GDPR, in addition to the legal basis applicable to the service.

This consent must be collected through a separate action, before the relevant data is collected. Simply and voluntarily sending health information does not, by itself, amount to explicit consent to its processing.

Access to this data is limited to authorized people who need it to provide the service, and to the technical providers necessary for its processing, within the limits of their tasks.

It is not used for targeted advertising.

You may refuse to provide this information or withdraw your consent at any time by writing to forme.nutrition2@gmail.com.

Withdrawal does not affect processing lawfully carried out beforehand. Processing based on this consent stops and the relevant data is deleted, subject to an applicable legal exception.

If certain information is essential for suitable personalization, its absence may prevent that particular service from being provided. Forme & Nutrition will inform you and look at possible solutions in accordance with the Terms. This refusal should not block services that do not require this information.

Collecting this data does not amount to a medical diagnosis or authorization to practice a healthcare profession.

5. Mandatory or optional information

Mandatory fields are marked on the forms.

Data needed for billing, payment and delivery of the offer is required to complete the order. Without it, Forme & Nutrition may not be able to provide the requested service.

Optional information may be left blank, with no impact on services that do not depend on it.

Refusing audience-measurement cookies does not prevent you from viewing offers, ordering, or using the site's essential features.

6. Recipients and service providers

Data is accessible to Ivan PAGÈS and, to the extent necessary for their tasks, to the following providers:

Provider	Role and data concerned
Supabase	Authentication, database and storage: accounts, orders, questionnaires, check-ins and files saved in the service
Stripe	Payments and subscriptions: data needed for the transaction, billing details, payment references and fraud-prevention information
Resend	Sending emails: recipient address, message content and technical delivery data
Vercel	Site hosting and operation: connection data, requests and information processed by the hosted application
Google Analytics	Audience measurement after consent: browsing data and technical identifiers related to this measurement
Email service used for email exchanges, notably Gmail	Contact details, messages received or sent, and any attachments

It is recommended to use the customer account to share sensitive information needed for follow-up, and to limit its presence in emails.

Strictly necessary information may also be shared with the accounting provider, professional advisors, the consumer mediator, or the competent authorities where a legal obligation or the handling of a dispute justifies it.

Providers acting on behalf of Forme & Nutrition operate under a contractual data-protection framework. Some, notably Stripe for certain regulatory or fraud-prevention operations, may also act as separate data controllers.

Further information:

These documents supplement this information without replacing Forme & Nutrition's obligations.

7. Location and international transfers

Some providers or their subcontractors may process data outside the European Economic Area, notably for hosting, sending emails, support or payment processing.

A European location for the database does not necessarily rule out access or processing from a third country.

Countries and safeguards, provider by provider:

Supabase (database, authentication, storage): project hosted in the eu-central-1 region (Frankfurt, Germany), within the European Economic Area. Residual access from a third country remains possible as part of the technical support provided by Supabase Inc. (a US company); where that occurs, it is covered by the European Commission's standard contractual clauses, in accordance with Supabase's data processing agreement.
Vercel (hosting): a US company; transfers to the United States are covered by the European Commission's standard contractual clauses, in accordance with its privacy policy.
Stripe (payments): some data may be processed in the United States; these transfers are covered by standard contractual clauses, in accordance with its privacy policy.
Resend (sending emails): a US company; transfers to the United States are covered by standard contractual clauses, in accordance with its data processing agreement.
Google Analytics: Google LLC is certified under the EU-US Data Privacy Framework and, as a supplementary safeguard, offers standard contractual clauses for transfers not covered by that framework. This framework is subject to ongoing legal challenges; Forme & Nutrition monitors developments and will update this section if needed.

Where a transfer relies on an adequacy decision, that decision must cover the recipient and processing concerned. Where it relies on standard contractual clauses, the safeguards and, where necessary, supplementary measures are verified.

You can request information about these safeguards and a copy of the relevant documents at forme.nutrition2@gmail.com.

8. Retention periods

Periods are set by category of data. Keeping an account that gives access to PDFs does not, by itself, justify keeping all health questionnaires or the detailed follow-up history.

Category	Period or rule
Account and access rights to purchased PDFs	For as long as contractual access is provided; on a closure request, information about the consequences and handling of the request subject to legal obligations
Accounts created without a purchase	3 years from the last login, unless reactivated in the meantime
Questionnaires, health data and detailed check-ins	During follow-up, then 12 months after the end of support or the last subscription renewal, unless consent is withdrawn earlier (deletion then without delay, subject to an applicable legal exception)
Personalized PDFs that may contain health information	The PDF itself remains accessible with no time limit, per the Terms; the detailed questionnaire answers used to prepare it follow the rule above (12 months after the end of support)
Support messages and follow-up exchanges	3 years from the last exchange, in line with CNIL recommendations on customer relationship management
Invoices and accounting records	Ten years from the close of the relevant financial year
Records needed to prove the contract or handle a dispute	Kept in restricted archive for the applicable limitation period (generally five years, Article 2224 of the French Civil Code); if proceedings are underway, until their final conclusion
Technical and security logs	12 months maximum, unless extended strictly as necessary for an ongoing security procedure or a legal obligation
Google Analytics data	Event data retention period set in the site's Google Analytics settings (maximum 14 months, beyond which Google automatically deletes the data)
Cookies and stored choices	Consent (fn_consent cookie) is remembered for 6 months; in line with CNIL recommendations, no non-essential cookie is kept beyond 13 months
Technical backups (Supabase)	Depending on the Supabase plan subscribed to: from 7 days (daily backups) to 28 days (point-in-time recovery option), after which backups are automatically deleted

Information no longer needed is deleted or irreversibly anonymized.

Exceptional retention of health data to defend legal rights may only concern strictly necessary elements and must rely on an exception applicable to such data. It does not justify systematically archiving all questionnaires.

9. Security and confidentiality

Forme & Nutrition implements technical and organizational measures proportionate to the nature of the data and the risks of processing.

These measures notably cover access restrictions, protection of administrator accounts, securing exchanges, managing permissions, and preventing unauthorized access to questionnaires and personalized PDFs.

Sensitive data must not be included in audience-measurement tools, page addresses, technical logs or notifications when not necessary.

You are asked to protect your login details and report any suspicious use of your account.

In the event of a personal data breach, notifications to the CNIL and to affected individuals are made where the conditions set out in the GDPR are met.

10. Cookies and audience measurement

Cookies and other trackers strictly necessary to provide a requested service, notably authentication and security, may be used without prior consent under legal conditions.

Google Analytics trackers are subject to your prior consent as implemented by Forme & Nutrition. They must not be activated before your agreement.

You can accept, refuse or customize your choices. Refusing must be as easy as accepting. Continuing to browse does not amount to consent.

You can change your choices and withdraw your consent at any time through the "Manage cookies" link available on the site.

The cookie management page states the trackers actually used, their providers, purposes and durations. It distinguishes necessary cookies from optional ones.

Health information, questionnaire content and follow-up messages are not shared with Google Analytics.

11. Personalization, automation and artificial intelligence

Personalization uses the information provided as part of the offer chosen.

As of the date of this policy, Forme & Nutrition does not use any artificial intelligence tool to automatically generate personalized programs or to make a decision about you: each program is prepared and validated manually by Ivan PAGÈS from the information you have provided.

There is therefore, as of today, no wholly automated decision producing legal effects or significantly affecting you within the meaning of Article 22 of the GDPR.

If an artificial intelligence tool were to be used in the future to prepare programs, this section would be updated before it goes into use to specify its role, the categories of data shared, its place among recipients, any international transfers, and the human oversight provided.

No transfer of health data to an artificial intelligence tool can be authorized merely by accepting this policy.

12. Your rights

Under the conditions set out in the GDPR and French data protection law, you can exercise:

The right of access: to know whether your data is processed and obtain a copy of it.
The right to rectification: to have inaccurate data corrected or completed.
The right to erasure: to request deletion of data where the conditions are met.
The right to restriction: to request that certain uses of your data be suspended.
The right to object: to object, on grounds relating to your particular situation, to processing based on a legitimate interest; objection to marketing is possible at any time.
The right to data portability: to retrieve the data you provided where it is processed automatically on the basis of the contract or your consent.
The right to withdraw your consent: at any time, without affecting the lawfulness of prior processing.
The right to give instructions on the fate of your data after your death, under the conditions set out in French law.

These rights are not absolute. Some data may need to be kept to comply with a legal obligation or to defend legal rights.

Cancelling a subscription, closing an account, and withdrawing consent to the processing of health data are separate steps. A deletion request is examined even if you have not previously closed your account.

13. Exercising your rights

Send your request:

By email: forme.nutrition2@gmail.com

Or by post:
Ivan PAGÈS — EI — Forme & Nutrition
9 rue Romain Rolland
13200 Arles, France

Please specify the right you wish to exercise and information that helps locate your account or request.

Additional proof of identity is only requested where there is reasonable doubt about your identity, and to a proportionate extent. A copy of an ID document is not systematically required.

You will receive a response within one month of receiving your request. This period may be extended by two months where the complexity or number of requests justifies it; you will be informed within the first month, with the reasons for the extension.

Exercising your rights is, in principle, free of charge. The exceptions provided for by the regulations, notably for manifestly unfounded or excessive requests, remain applicable.

In the event of a full or partial refusal, you will be informed of the reasons and available remedies.

14. Complaint to the CNIL

You can file a complaint with the French data protection authority:

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr
Complaints: www.cnil.fr/fr/plaintes

You can contact Forme & Nutrition about any difficulty; doing so is not a mandatory precondition for contacting the CNIL.

15. Minors

The offers and customer account are reserved for adults.

If Forme & Nutrition learns that data has been collected from a minor through these services, the processing is reviewed and unnecessary data is deleted, subject to applicable legal obligations.

16. Changes to this policy

This policy may change to reflect the processing actually carried out, the providers used, or the regulations.

The update date is shown at the top of this document. Any significant change is brought to your attention by an appropriate means.

Where new processing requires your consent, it is collected before that processing begins. Publishing a new policy does not replace that consent.